I have always made the assumption that the mobile phone network was fairly robust and that we could rely on it to communicate during an incident. I generally put a caveat on use of mobile phones in the immediate aftermath of the incident because the system can very quickly become overloaded and then you cannot connect to the network. This happened in London during the 7/7 bombings and people were unable to call and say they were safe.
Excluding the immediate area of the incident, on the whole we can rely on our mobiles and use them for communication during unforeseen circumstances. In fact, during an incident a smartphone can act as a mini incident room, ensuring emails can be sent, holding copies of the plans and contact numbers and allowing the user to get information from the internet. The O2 outage (the mobile system failed for O2 users in the UK) this week took me by surprise as I didn’t think there would be such a large outage. I imagined individual cells could go down but not a whole system.
In the same way I didn’t imagine that as a result of the Ulster Bank / RBS/ Nat West incident, companies could have their bank accounts ‘locked’ for several weeks leaving them unable to receive money and pay suppliers and staff. Having no access to money through the cash point system is bad enough, but being locked out of your bank account could mean failure for small businesses. I was speaking to one of our BCT tutors and he was saying that he advised his clients to have a business account at two different banks for this purpose.
The reason for my choice of title for this week’s bulletin is that as business continuity people we know that buildings, plant, equipment and IT systems fail and we put plans in place for dealing with them. The difficulty lies in the fact that in the end you have to rely on the critical infrastructure of the country you operate in. We can put plans in place for standby generators if the power fails and then move to another location if our network or telecoms fails, but there comes a point where in the event of a long term failure of infrastructure no business continuity plan would be able to deal with it. If the electricity failed for a region or country for weeks on end, even if we had a standby generator we might find it difficult to sustain our business. Even if we were up and operating, our customers may be so badly affected that they would not be able to purchase or use our goods and services, and our staff would not be able to live in the area without electricity and may have to move elsewhere to get power. The city of Wellington incident in New Zealand in the 1990’s is a good example of this, when the power to a major city failed for six weeks.
When I am teaching the BCI’s 5-day course there is a section saying that you should state the maximum survivable incident. I have always been sceptical about this section as should you say ‘if there is an incident of a meteor hitting the earth similar to the one which wiped out the dinosaurs then our plan would not be able to cope with it’. Is there any point in putting this in your plan?
These incidents have proved that we need to revisit our assumptions of what we think will be always in place and look into what our plans rely most on. Can we trust the mobile phone system to always be working or our bank’s IT systems not to fail, or do we need to build resilience and develop strategies for their failure?
I would welcome any comments or thoughts on whether you think we should state our worst case scenario, and if we should write down the level beyond which our plan would not cope.
